Skip to content
Fencer Vulns
high 8.2

CVE-2026-12382 json

Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing

published 2026-07-15 3 mo ago modified 2026-08-12 2 mo ago also EUVD-2026-44739

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.

Patch / fix

  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20260715-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20260715-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.20260422-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 1777311120
  • Red Hat Red Hat Ansible Automation Platform 2.7 1783919486
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.6-1.el8ap
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.6-1.el9ap
  • receptorctl ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.6-1.el8ap
  • receptorctl ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.6-1.el9ap
  • ansible-core ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1:2.16.19-1.el8ap
  • ansible-core ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1:2.16.19-1.el9ap
  • ansible-test ansible automation platform 2.5 1:2.16.19-1.el8ap
  • ansible-test ansible automation platform 2.5 1:2.16.19-1.el9ap

red hat advisories RHSA-2026:42078RHSA-2026:13508

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-12382 updated cvss 8.2

aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing

  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-server 2.5.20260715-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-server 2.5.20260715-1.el9ap
    fixed: vendor fix RHSA-2026:42078
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1777311120
    fixed: vendor fix RHSA-2026:13545
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-gateway-server 2.6.20260422-1.el9ap
    fixed: vendor fix RHSA-2026:13508
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1783919486
    fixed: vendor fix RHSA-2026:42142
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.6-1.el8ap, receptorctl 1.6.6-1.el8ap, ansible-core 2.16.19-1.el8ap, ansible-test 2.16.19-1.el8ap, automation-hub 4.10.16-1.el8ap, python3.12-pyjwt 2.13.0-1.el8ap, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.6-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-core 2.16.19-1.el9ap, ansible-test 2.16.19-1.el9ap, automation-hub 4.10.16-1.el9ap, python3.12-pyjwt 2.13.0-1.el9ap, +20 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform 1777410604, ansible-automation-platform 1777410621, ansible-automation-platform-26 1777163004, ansible-automation-platform-26 1777163348, ansible-automation-platform-26 1777163557, ansible-automation-platform-26 1777163594, +23 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.4-2.el9ap, yamllint 1.38.0-1.el9ap, receptorctl 1.6.4-2.el9ap, ansible-lint 26.1.1-1.el9ap, ansible-core 2.16.18-1.el9ap, ansible-test 2.16.18-1.el9ap, +46 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.4-3.el10ap, yamllint 1.38.0-2.el10ap, receptorctl 1.6.4-3.el10ap, ansible-lint 26.1.1-2.el10ap, python-black 26.3.1-2.el10ap, ansible-core 2.16.18-2.el10ap, +7 more Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1783919521, ansible-automation-platform-27/hub-web-rhel9 1783921568, ansible-automation-platform-27/receptor-rhel9 1783917963, ansible-automation-platform-27/mcp-tools-rhel9 1783918403, ansible-automation-platform-27/controller-rhel9 1783921344, ansible-automation-platform-27/de-minimal-rhel9 1783918892, +25 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Ansible Automation Platform 2.7

Classification

Weakness
  • CWE-290 Authentication Bypass by Spoofing

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.